Privacy Policy
Last updated October 17, 2026
This policy explains how SBT Capital LLC ("we") handles personal information in Delora Legal. Law firms use Delora Legal to manage their practice. The information a firm enters about its clients and matters belongs to the firm: we process it on the firm's behalf and only as described here and in our Terms of Service.
What we collect
- Account information: the names, email addresses, roles and job titles of your firm's users, their password hashes (never the passwords themselves) and, if they turn on two-step verification, an encrypted authenticator key.
- Your firm's content: contacts, matters, calendar entries, tasks, time and expenses, bills, bank and trust ledger entries, documents information and communications that your users enter.
- People your firm works with: when your firm sends a document for electronic signature, each signer's name and email address, the IP address and browser they signed from, when they opened, agreed and signed, and the signature they typed or drew. Email sent or forwarded to a matter's filing address. When a client pays a bill online, the payment's amount and status as Stripe reports it (card and bank details are entered on Stripe's page and never reach us).
- Connected calendars: if a user connects Google Calendar or Microsoft 365, an encrypted access token and the entries in the calendar Delora Legal keeps there. If the user turns on "Don't offer consultation times when I'm busy", also when they are busy in their main calendar over the next two weeks: start and end times only, never titles, guests or places, used only to leave those times out of the consultation times their firm offers, and deleted when they turn it off or disconnect.
- Security and operations data: sign-in attempts with IP addresses (to stop password guessing), an audit log of important changes, whether emails we send were delivered, bounced or marked as spam, and error reports (with page addresses but not their query strings).
How we use it
- to provide Delora Legal: sign-in, storing and showing your records, and sending the emails your users ask for (invitations, password links, bills, payment reminders, client email and signature requests);
- to keep it secure and reliable: preventing abuse, investigating problems, and backing up data;
- to support you when you ask for help;
- to meet legal obligations.
We do not sell personal information, use it for advertising, or train artificial intelligence models on your firm's content.
Who we share it with
We share information only with the service providers that run Delora Legal, and only as they need it:
- Amazon Web Services: database hosting, encrypted backups and email delivery (United States, Oregon region);
- Vercel: hosting of the application itself (United States);
- Stripe: if your firm connects its own Stripe account to take online payments, the bill's amount and number, the firm's name and the client's email address, to show the client a payment page;
- Google and Microsoft: if a user connects their calendar, the entries they choose to sync.
We may also disclose information when the law requires it. Where we lawfully can, we will tell the affected firm first so it can object, for example to protect privileged material.
How we protect it
- Encryption in transit (TLS, including between our servers and the database, with the database certificate verified) and at rest.
- Sign-in protections: password rules, rate limiting, optional or firm-required two-step verification, and session timeouts.
- Each firm's data is kept separate from every other firm's; money records and the audit log cannot be altered after the fact.
- Continuous backups with 14-day point-in-time recovery, and monitoring with alerts.
How long we keep it
We keep your firm's data while it uses Delora Legal. After an account is closed, the firm can export its data for 30 days, then we delete it from the live service within 90 days, after which it ages out of backups. Sign-in attempt records are kept for about a day, email received at a filing address is kept as received for 30 days (what is filed stays with the matter), and error reports are kept for 90 days. Your firm decides how long to keep its own records and may need to keep some (such as trust account records) for years under professional rules.
Your choices and rights
Users can see and update their profile in Settings. Because a firm controls its own data, requests about information a firm holds about you (for example, as its client) should usually go to that firm, and we will help the firm respond. You can also write to us at serhiy.tkach@sbtcap.com to ask about, correct or delete personal information we hold, and we will respond as the law requires. A data processing agreement is available to firms on request.
Children
Delora Legal is a professional service and is not intended for children.
Changes
We will update this page when our practices change and notify firms by email or in the app of material changes.
Contact
SBT Capital LLC · serhiy.tkach@sbtcap.com